OK, so there might be a flash of un-logged-in content, but there’s not much that we can do about that at this time.
So we’re talking about getting the current logged-in status via one of:
- IFRAME + redirect
- JSON get requiring CORS headers etc
- JSONP script
Last seems like the simplest for both Discourse and the SSO provider to implement.